Closed missing _files/js causes the release builder to package the entire XenForo js directory

[Painbaker]

Affected version

2.3.13

When an add-on build.json contains:

{
    "additional_files": [
        "js/"
    ]
}

but src/addons/ExampleAddon/_files/js does not exist, running php cmd.php xf-addon:build-release ExampleAddon


includes the installation’s entire js directory under upload/js/, including XenForo core files and other add-ons assets

Cause: In XF\Service\AddOn\ReleaseBuilderService::prepareFilesToCopy(), a missing _files path silently falls back to the XF root:

$filePath = $rootPath . $ds . $additionalFile;

The resulting directory is then copied recursively


Suggested fix: Reject fallback to an entire top-level directory

diff --git a/src/XF/Service/AddOn/ReleaseBuilderService.php b/src/XF/Service/AddOn/ReleaseBuilderService.php
--- a/src/XF/Service/AddOn/ReleaseBuilderService.php
+++ b/src/XF/Service/AddOn/ReleaseBuilderService.php
@@ -160,6 +160,15 @@
 				{
 					continue;
 				}
+
+				if (is_dir($filePath)
+					&& dirname(realpath($filePath)) === realpath($rootPath))
+				{
+					throw new PrintableException(
+						'Cannot include an entire top-level directory. Specify a scoped path.'
+					);
+				}
+
 				$root = $rootPath;
 			}

 

[XF Bug Bot]

Automated triage: Closed

Thank you for reporting this issue. Paths listed in additional_files are taken from the add-on's _files directory if they exist there, and otherwise from the XenForo root. With no _files/js, an entry of "js/" refers to the whole js directory, so the builder includes all of it. A scoped path such as js/Vendor/AddOn avoids this.

This is an automated assessment. A member of staff may review and update it.

 

[Painbaker]

However this is unexpected behavior (unlikely that anyone would want to or expect to pack the entire root js in their addon